Topic: mod_security and apache 2.2.4

[chuck1rar]

Just upgraded to apache 2.2.4 and also latest build of mod_security.

But cant get them both working together now..

Below have included the script for mod_security but this has not changed since the last version so was trying to work out why apache will not start with mod_security... Any help would be appreciated.

Thanks


<IfModule mod_security.c>

# Turn ModSecurity On
SecFilterEngine On

#SecFilterScanPOST On
SecFilterCheckURLEncoding On
SecFilterCheckUnicodeEncoding Off

# Accept almost all byte values
SecFilterForceByteRange 1 255

# Server masking is optional
SecServerSignature "NOYB"

#SecUploadDir logs
#SecUploadKeepFiles Off

# Only record the interesting stuff
SecAuditEngine RelevantOnly
SecAuditLog logs/sec.log

## -- Common attacks --------------------

SecFilterDefaultAction "deny,log,msg:'Common attacks',status:403"

#Web Proxy GET Request
SecFilter "^GET (http|https|ftp)\:/"
#Web Proxy HEAD Request
SecFilter "^HEAD (http|https|ftp)\:/"
#Proxy POST Request
SecFilter "^POST (http|https|ftp)\:/"
#Proxy CONNECT Request
SecFilterSelective THE_REQUEST "^CONNECT "

# Only accept request encodings we know how to handle.
SecFilterSelective REQUEST_METHOD "!^(GET|HEAD)$" chain
#SecFilterSelective HTTP_Content-Type "!(^application/x-www-form-urlencoded$|^multipart/form-data;)"

# Do not accept GET or HEAD requests with bodies
SecFilterSelective REQUEST_METHOD "^(GET|HEAD)$" chain
SecFilterSelective HTTP_Content-Length "!^$"

# Restrict which request methods can be used
SecFilterSelective REQUEST_METHOD "!^(GET|HEAD|POST)$"

# Restrict protocol versions.
SecFilterSelective SERVER_PROTOCOL "!^HTTP/(0\.9|1\.0|1\.1)$"

# Require Content-Length to be provided with every POST request.
SecFilterSelective REQUEST_METHOD "^POST$" chain
SecFilterSelective HTTP_Content-Length "^$"

# Don't accept transfer encodings we know we don't know how to handle
SecFilterSelective HTTP_Transfer-Encoding "!^$"

## -- PHP attacks --------------------

SecFilterSignatureAction "log,deny,msg:'PHP attack'"

# Possible code execution attack (targets valid PHP streams constructs)
SecFilterSelective ARGS_NAMES "^php:/"

#phpBB attack
SecFilterSelective ARG_highlight "(\x27|%27|\x2527|%2527)"

## -- Awstats-------------------------

SecFilterSignatureAction "log,deny,msg:'Awstats Attack'"
SecFilterSelective ARGS_NAMES "configdir"

## -- SQL Injection Attacks --------------------

SecFilterSignatureAction "log,deny,msg:'SQL Injection attack'"

# Generic
SecFilterSelective ARGS "delete[[:space:]]+from"
SecFilterSelective ARGS "drop[[:space:]]+database"
SecFilterSelective ARGS "drop[[:space:]]+table"
SecFilterSelective ARGS "drop[[:space:]]+column"
SecFilterSelective ARGS "drop[[:space:]]+procedure"
SecFilterSelective ARGS "create[[::space:]]+table"
SecFilterSelective ARGS "update.+set.+="
SecFilterSelective ARGS "insert[[:space:]]+into.+values"
SecFilterSelective ARGS "select.+from"
SecFilterSelective ARGS "bulk[[:space:]]+insert"
SecFilterSelective ARGS "union.+select"
SecFilterSelective ARGS "or.+1[[:space:]]*=[[:space:]]1"
SecFilterSelective ARGS "alter[[:space:]]+table"
SecFilterSelective ARGS "or 1=1--'"
SecFilterSelective ARGS "'.+--"

# MySQL
SecFilterSelective ARGS "into[[:space:]]+outfile"
SecFilterSelective ARGS "load[[:space:]]+data
SecFilterSelective ARGS "/\*.+\*/"


## -- Command execution --------------------

SecFilterSignatureAction "log,deny,msg:'Command execution attack'"

#SecFilterSelective ARGS_VALUES "^(uname|id|ls|rm|kill)"
#SecFilterSelective ARGS_VALUES "^(ls|id|pwd|wget)"
#SecFilterSelective ARGS_VALUES ";[[:space:]]*(ls|id|pwd|wget)"

</IfModule>

[Steffen]

The latest is ModSecurity 2 which is not backward compatible with ModSecurity 1.x rules. See the readme in the .zip.

[chuck1rar]

Yeah I know but was not using version 1.x before was on version 2....

[Steffen]

But above rules are 1.x rules.

Example of 2 rules:

[chuck1rar]

Yeah sorry realised that later but removed all the rules and just tried starting apache with the modules enabled but when mod_security is enabled then apache will not start..

Any tips on how to debug this..
Nothing relevenat is in any of the logs..

Thanks

[James Blond]

What does the error.log tell about that error?
Did you download the right version for your apache?

[chuck1rar]

nothing in the error log at all cause apache fails to start...

Am using Apache 2.2.4 Win32 mod_ssl 2.2.4 OpenSSL 0.9.8e and JRUN4 CFMX7..

The version of mod_security I downloaded was 2.1.0...

Was working fine till I moved from apache 2.2.3...

Thanks

[rebelo]